The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted natural language requests and reads external SKILL.md contracts to resolve program operators. This ingestion of content from multiple sources represents a surface for indirect prompt injection, where malicious instructions could be embedded in those inputs to influence the compilation process.
Ingestion points: The skill captures user requests and reads external SKILL.md contracts to resolve operators, as described in the SKILL.md file.
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when interpolating these inputs into the compilation context.
Capability inventory: The skill is authorized to read skill contracts across the environment and write bundles of files (including request.md, program.md, and compile-notes.md) to the sem-programs/ directory.
Sanitization: The instructions do not define any sanitization, escaping, or validation steps for the captured text or the content read from external skill contracts.

sem-compile